XAMBoost VPN SaaS Panel

Production-ready VPN subscription SaaS panel built with plain PHP and SQLite for shared hosting.

Features

• Dynamic external JSON source with editable URL and a 60-second file cache
• No server storage of VPN servers in SQLite
• Setup wizard for admin credentials, branding, API token, and source URL
• Admin panel with authentication, plans, subscriptions, and settings
• Public subscription page with HTML or JSON output depending on client intent
• Multi-format delivery:
  • /subscription/{id} raw meta + untouched source JSON + routing
  • /subscription/{id}?format=happ sing-box/Happ config
  • /subscription/{id}?format=source original source JSON exactly
• Token-based API for create, extend, delete, enable/disable, Telegram binding, and config retrieval
• Server rename mapping for Happ tags and public display only
• Clean URLs via .htaccess

Upload / First Run

1. Upload the entire project to your PHP shared hosting directory.
2. Ensure PHP has pdo_sqlite enabled and write access to:
   • db.sqlite
   • cache/
   • uploads/
3. Open the site root in a browser.
4. Complete /setup on first launch.
5. Sign in at /login.

API Auth

Use one of these:

• Authorization: Bearer YOUR_TOKEN
• X-API-Token: YOUR_TOKEN
• ?token=YOUR_TOKEN

API Examples

Create a subscription:

curl -X POST "https://your-domain.com/api/create-subscription" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -d "name=Premium User" \
  -d "description=Primary subscription" \
  -d "badge=PRO" \
  -d "telegram_id=123456789" \
  -d "plan_id=monthly-pro"

Extend a subscription by 30 days:

curl -X POST "https://your-domain.com/api/extend-subscription" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -d "id=SUBSCRIPTION_ID" \
  -d "days=30"

Disable a subscription:

curl -X POST "https://your-domain.com/api/disable-subscription" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -d "id=SUBSCRIPTION_ID"

Assign Telegram ID:

curl -X POST "https://your-domain.com/api/assign-telegram" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -d "id=SUBSCRIPTION_ID" \
  -d "telegram_id=987654321"

Get default routed JSON:

curl "https://your-domain.com/api/subscription/SUBSCRIPTION_ID" \
  -H "Authorization: Bearer YOUR_TOKEN"

Get Happ config:

curl "https://your-domain.com/api/subscription/SUBSCRIPTION_ID/happ" \
  -H "Authorization: Bearer YOUR_TOKEN"

Get untouched source JSON:

curl "https://your-domain.com/api/subscription/SUBSCRIPTION_ID/source" \
  -H "Authorization: Bearer YOUR_TOKEN"

Notes

• schema.sql is the DB init script.
• db.sqlite is auto-created if missing.
• Original source JSON is never modified or persisted in SQLite.
• Routing rules always prioritize ru -> direct, then all other traffic -> proxy.